Security
Security at AxiaForce.
AxiaForce is designed with enterprise security principles and controls appropriate to the nature of the Services. Here is how your information is protected.
- dedicated domain
- dedicated database · db-acme
- own keys · own secrets
- region us-east
- dedicated domain
- dedicated database · db-harbor
- own keys · own secrets
- region us-west
- dedicated domain
- dedicated database · db-your-co
- own keys · own secrets
- region eu-west
Controls
How the Services are protected.
The measures below describe how the Services are designed and operated. No system is completely secure, and we do not promise otherwise.
- 01
Secure software development
Changes go through version control, code review, and automated testing before they are released, and dependencies are checked for known vulnerabilities as part of the build.
- 02
Access controls and least privilege
Access to the Services is role-based, and access to systems and Customer Data inside AxiaForce is limited to what a person needs to do their job.
- 03
Multi-factor authentication
Multi-factor authentication is used where it is supported by the identity providers and platforms involved.
- 04
Encryption
Connections to the Services are encrypted in transit. Customer Data is encrypted at rest where supported by the underlying infrastructure. We confirm the specifics for a customer during security review.
- 05
Tenant isolation and environment separation
Customer environments are separated by design. A customer’s information is kept in its own tenant environment, and AI employees work only within the tenant they serve. Production and non-production environments are kept separate.
- 06
Logging and monitoring
Activity in the Services, including actions taken by AI employees and the approvals behind them, is recorded, and operational monitoring is used to detect problems.
- 07
Vulnerability management
We track and apply security updates to the software we depend on, and address vulnerabilities we find or are told about.
- 08
Incident response
We maintain a process to investigate, contain, and communicate about security incidents, and to notify affected customers as required by agreement and applicable law.
- 09
Backups and recovery
Backup and recovery capabilities are provided through our infrastructure providers. Recovery objectives, where a customer needs specific ones, are set in an enterprise agreement.
- 10
Vendor oversight
We select and review the third parties that help provide the Services and expect them to protect information appropriately.
- 11
Customer-specific permissions
Customers choose which systems to connect and what access to grant, and can revoke it. AI employees act only within the access granted.
- 12
Approval controls for AI employees
Customers decide which actions an AI employee may take on its own and which need a person to approve. Approvals and actions are recorded.
- 13
Data retention and deletion
Retention and deletion follow the customer’s agreement. Customers can ask for their data to be deleted or returned as the agreement provides.
- 14
Responsible AI controls
AI employees work from the context they are given, inside the permissions granted, with human review for the actions a customer gates. AxiaForce does not use Customer Data to train generalized models for unrelated third-party use unless expressly authorized or disclosed.
Documentation
Security documentation.
Everything is online. Start with the Security Framework, then the other documents from the Trust & Security links in the footer.
- Security FrameworkSecurity principles and controls
- Data Processing AddendumHow personal data is processed for customers
- Acceptable Use PolicyRules for using the Services
- Privacy PolicyHow we handle personal data
- Master SaaS TermsThe terms for AxiaForce Services
- SLA / Support PolicySupport channels and response objectives
- Cancellation & Refund PolicyRenewal, cancellation and refunds
See how AxiaForce can help your business grow.
Book a demo to see AI employees take on the work, and get the inside track as we add more.